{"api_version":"1","generated_at":"2026-10-15T13:32:36+00:00","cve":"CVE-2025-2240","urls":{"html":"https://cve.report/CVE-2025-2240","api":"https://cve.report/api/cve/CVE-2025-2240.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-2240","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-2240"},"summary":{"title":"Smallrye-fault-tolerance: smallrye fault tolerance","description":"A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.","state":"PUBLISHED","assigner":"redhat","published_at":"2025-03-12 15:15:42","updated_at":"2026-08-13 20:17:13"},"problem_types":["CWE-1325","CWE-1325 Improperly Controlled Sequential Memory Allocation"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:3376","name":"https://access.redhat.com/errata/RHSA-2025:3376","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4","name":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2025:3543","name":"https://access.redhat.com/errata/RHSA-2025:3543","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351452","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2351452","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2025:3541","name":"https://access.redhat.com/errata/RHSA-2025:3541","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2025-2240","name":"https://access.redhat.com/security/cve/CVE-2025-2240","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2240","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2240","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat build of Apache Camel 4.8.5 for Spring Boot","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat build of Quarkus 3.15.4","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 2","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat build of Quarkus","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Fuse 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Integration Camel K 1","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2025-03-12T02:23:44.660Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2025-03-12T00:00:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"2240","cve":"CVE-2025-2240","epss":"0.009840000","percentile":"0.593850000","score_date":"2026-08-16","updated_at":"2026-08-17 00:01:09"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-2240","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-03-12T15:08:58.646132Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2025-05-12T15:37:42.110Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://github.com/smallrye/smallrye-fault-tolerance","defaultStatus":"unaffected","packageName":"smallrye-fault-tolerance-core","versions":[{"lessThan":"6.4.2","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThan":"6.9.0","status":"affected","version":"6.5.0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_spring_boot:4.8.5"],"defaultStatus":"unaffected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Apache Camel 4.8.5 for Spring Boot","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3.15"],"defaultStatus":"unaffected","packageName":"quarkus-camel-bom","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3.15"],"defaultStatus":"unaffected","packageName":"quarkus-cxf-bom","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:quarkus:3.15::el8"],"defaultStatus":"unaffected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Quarkus 3.15.4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_registry:2"],"defaultStatus":"affected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Apicurio Registry 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apicurio_registry:3"],"defaultStatus":"unaffected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Apicurio Registry 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3"],"defaultStatus":"unaffected","packageName":"smallrye-fault-tolerance-apiimpl","product":"Red Hat build of Quarkus","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"unknown","packageName":"smallrye-fault-tolerance-core","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:integration:1"],"defaultStatus":"affected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat Integration Camel K 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"affected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"smallrye-fault-tolerance-core","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"}],"datePublic":"2025-03-12T00:00:00.000Z","descriptions":[{"lang":"en","value":"A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1325","description":"Improperly Controlled Sequential Memory Allocation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-13T19:38:11.600Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"RHSA-2025:3376","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:3376"},{"name":"RHSA-2025:3541","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:3541"},{"name":"RHSA-2025:3543","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:3543"},{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-2240"},{"name":"RHBZ#2351452","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351452"},{"url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4"}],"timeline":[{"lang":"en","time":"2025-03-12T02:23:44.660Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-03-12T00:00:00.000Z","value":"Made public."}],"title":"Smallrye-fault-tolerance: smallrye fault tolerance","workarounds":[{"lang":"en","value":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-1325: Improperly Controlled Sequential Memory Allocation"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2025-2240","datePublished":"2025-03-12T14:55:15.889Z","dateReserved":"2025-03-12T02:36:02.101Z","dateUpdated":"2026-08-13T19:38:11.600Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-03-12 15:15:42","lastModifiedDate":"2026-08-13 20:17:13","problem_types":["CWE-1325","CWE-1325 Improperly Controlled Sequential Memory Allocation"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-12T15:08:58.646132Z","id":"CVE-2025-2240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"2240","Ordinal":"1","Title":"Smallrye-fault-tolerance: smallrye fault tolerance","CVE":"CVE-2025-2240","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"2240","Ordinal":"1","NoteData":"A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.","Type":"Description","Title":"Smallrye-fault-tolerance: smallrye fault tolerance"}]}}}